{
  "slug": "trail-of-bits",
  "name": "Trail of Bits",
  "url": "https://www.trailofbits.com",
  "hq": "New York, United States",
  "founded": "2012",
  "focus": "AI-native security practice: Buttercup, 201 open-source skills, about 20 percent of reported bugs first surfaced by AI, all human-validated",
  "summary": "Trail of Bits built Buttercup, the AIxCC runner-up, and has reorganised its audit practice around AI: it reports 15 to 200 AI-surfaced candidate bugs per week on suitable engagements, about 20 percent of reported findings first surfaced by AI, every one validated by an auditor, and publishes 201 skills and 94 plugins as open source. It has a cryptography and ZK practice.",
  "why_first": "",
  "services": [
    "AI-assisted security audits with human validation",
    "Buttercup and open-source skills",
    "Cryptography, ZK and blockchain audits"
  ],
  "tools": [
    "buttercup"
  ],
  "evidence": [
    [
      "How we made Trail of Bits AI-native (2026-03-31)",
      "https://blog.trailofbits.com/2026/03/31/how-we-made-trail-of-bits-ai-native-so-far/"
    ],
    [
      "Trail of Bits skills",
      "https://github.com/trailofbits/skills"
    ]
  ],
  "fit": [
    "Choose Trail of Bits for a broad AI-assisted audit of C, Rust and application code with a strong cryptography bench."
  ],
  "rank": 2,
  "page": "https://agentsast.com/firms/trail-of-bits/",
  "updated": "2026-09-13"
}